Transcription
D E F E N D F O R WA R DA Proactive Modelfor Cyber Deterrence
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEWe are allone big blueteam.STEVE BENTONEMERITUS CSO AND FORMER DIRECTOR OFPROTECT BT SERVICES & OPERATIONS, BT2SPONSORED BY
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEContentsABOUT THE CYBER DEFENDERS COUNCIL4EXECUTIVE SUMMARY5THE ORIGINS OF DEFEND FORWARD6WHAT IT MEANS TO DEFEND FORWARD8ADAPTING DEFEND FORWARD FOR THE GLOBAL PRIVATE SECTOR9GROWING SUPPORT FOR PROACTIVE DETERRENCE11THE SIX PRINCIPLES OF DEFEND FORWARD13PRINCIPLE 1 ASSUME YOU’RE AT RISK14PRINCIPLE 2 UNDERSTAND THE THREAT16PRINCIPLE 3 COLLABORATE ACROSS SECTORS17PRINCIPLE 4 USE INTELLIGENCE TO INSTILL A BIAS FOR ACTION19PRINCIPLE 5 LEVERAGE LARGE-SCALE ANALYTICS AND TECHNOLOGY21PRINCIPLE 6 CONCLUSION: ASSUME YOU’RE STILL AT RISK22COUNCIL MEMBERS3SPONSORED BY23
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEABOUTThe Cyber DefendersCouncilThe Cyber Defenders Council is an independent group of preeminentcybersecurity leaders from public- and private-sector organizationsaround the world. The mission of the Council is to adapt anapproach to cyber deterrence, known as “Defend Forward,” forprivate-sector enterprises and to provide prescriptive guidanceto help organizations implement Defend Forward cybersecuritystrategies that increase costs for attackers and improve theefficacy of Defenders. The Cyber Defenders Council is sponsored byCybereason.4SPONSORED BY
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEExecutive SummaryMake itMake itMake itEXPENSIVEDANGEROUSWORTHLESSThose are the design principles around which UKThis report explores the origins and principles of Defendtelecommunications provider BT built its security program.Forward. It captures insights from General JosephThe company sought to make it cost prohibitive forDunford, the 19th chairman of the US Joint Chiefs of Staff,attackers to conduct successful attacks, legally perilousand showcases recommendations from Cyber Defendersfor them to try, and to eliminate financial incentives forCouncil members who serve as top security executivesattackers by making its sensitive data a worthless target.and advisors across a range of organizations and industryBT’s program captures the spirit of an emergingapproach to cybersecurity known as Defend Forward.This approach places increased focus on deterrence,intelligence sharing, and defending with an offensivemindset. As the lines between nation-state sponsoredand financially motivated cybercrime attacks continue toblur, and as government officials around the world warnbusinesses to prepare for cyberattacks stemming fromgeopolitical conflicts, Defend Forward seeks to empowerdefenders with the proactive strategies and bias for actionthey need to confront motivated adversaries.5SPONSORED BYverticals. Council members met privately in March andApril of 2022 under the Chatham House Rule to share theirimpressions of Defend Forward and discuss ways securityleaders can put some of its principles into practice in theprivate sector.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEThe Origins of Defend ForwardThe Defend Forward concept emerged from the USDepartment of Defense 2018 National Cyber Strategy.Senior Defense Department leaders had grownincreasingly concerned about the sophisticated waysin which certain nation-states were bringing togethereconomic coercion, political influence, informationoperations, cyber operations, and conventional andunconventional military operations to advance theirnational interests.The evidence of those nation states’ persistent effortsto project power globally and compete with the US incyberspace showed up in a staggering series of cyberincidents, including interference in the 2016 election, thecrippling 2017 WannaCry and NotPetya attacks, the 2017theft of cyber tools from the US National Security Agency(NSA), corporate intellectual property theft, as well as themassive US Office of Personnel Management and Equifaxdata breaches.6SPONSORED BYBecause the outcomes from those cyberattacks did notmeet the threshold to elicit a traditional kinetic militaryresponse, there was little the US government and militarycould do to intervene proactively. The United States’diplomatic and military posture in the years leading up to2018 had been to focus on deterrents to cyber aggressionand only respond in the event deterrence failed.Defense Department leaders realized that the kind ofadversarial competition in which certain nation-stateswere engaging demanded new, more proactive andinnovative ways of integrating the elements of nationalpower. Defend Forward became the cyber component of anew strategic approach to this competition.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEOn a day to day basis, we were on the sidelines,watching as nation-state threat actors interfered inour democracy and stole priceless trade secrets fromour private-sector enterprises. It became clear tome that if we were going to continue followingthis military strategy of only reacting in theevent deterrence failed, the US was going tofind itself at a very significant disadvantage. I alsobelieved that if our democracy or our nation’s criticalinfrastructure was being threatened, we ought not tobe sitting on the bench admiring those problems.GENERAL JOSEPH DUNFORDTHE 19TH CHAIRMAN OF THE US JOINT CHIEFS OF STAFF7SPONSORED BY
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEWhat It Means to Defend ForwardAs described in the Department of Defense Cyber Strategy, Defend Forward means proactivelydisrupting or stopping malicious cyber activity before it reaches its targets. This approach relies on:8SPONSORED BYINTELLIGENCECollecting intelligence about adversary tactics, techniques andprocedures (TTPs).RESILIENCYStrengthening the security of systems and networks to makeit harder–and more costly–for adversaries to achieve theirobjectives, and if possible, to deter them from trying.COLLABORATIONWorking closely with peers in law enforcement, across andbetween industry verticals, and between the public and privatesectors to bolster an informed defense that does not includeany illegal counter-engagement.CAPABILITIESDeveloping scalable, adaptable, lawful and diverse capabilitiesfor countering adversary actions and activities.ANALYTICSUsing enterprise cybersecurity solutions to operate atmachine speed, combined with large-scale data analytics, toidentify malicious activity in its earliest stages across disparatenetworks and system assets.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEAdapting Defend Forward forthe Global Private SectorDefend Forward remains as relevant a cybersecuritystrategy today as it was in 2018, especially as the worldbraces for cyberattacks stemming from the conflictbetween Russia and Ukraine. While the Department ofDefense definition of Defend Forward includes offensiveactivities in which private sector enterprises cannotengage, there is much for the private sector to gleanfrom both the proactive “take the fight to the adversary”perspective and the focus on deterrence.9SPONSORED BY“If our adversaries are going to be persistent in cyberspaceevery day, and if we continue to rely on a passive, firewallmindset, we’ll never be successful against them,” saysGeneral Dunford.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEDefend Forward doesn’t have to mean hacking back,but it does mean acting proactively and with purpose–on the basis of intelligence–to anticipate and disruptthreats. It’s about putting attackers on theirheels instead of defenders getting caughtby surprise. It’s about defending with an offensivemindset, and an offensive mindset is not illegal.GENERAL JOSEPH DUNFORDTHE 19TH CHAIRMAN OF THE US JOINT CHIEFS OF STAFF10SPONSORED BY
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEGrowing Support forProactive DeterrenceLeading global organizations are already moving in thedirection of adopting Defend Forward principles. Forexample, Philipp Amann, the head of strategy at theEuropean Cybercrime Centre (EC3), says Defend Forwardaligns with the proactive, deterrence-focused approachsupported by EC3 in dealing with cyber adversaries. Asexamples, Amann cites the regulatory and technologywatch function that EC3 established in 2013 to assess theways in which malicious actors could abuse emergingtechnologies, along with the No More Ransom initiative thathelps organizations recover their data without paying aransom to attackers.11SPONSORED BYSimilarly, the security program at BT is built around threeobjectives aimed at deterring attacks, according to SteveBenton, emeritus CSO of BT and former director ofProtect BT Services & Operations:
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEMake itMakeattacksMakeattacks12SPONSORED BYEXPENSIVEfor an adversary to wage asuccessful attack on the company.DANGEROUSfor adversaries via a strong digitalforensics team capable of gatheringevidence that allows law enforcementpartners to identify actors and bring themto justice.WORTHLESSto adversaries by encrypting valuable dataat rest or in motion and taking proactivesteps to protect customers from fraud.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEThe Six Principlesof Defend Forward1 ASSUME YOU'RE AT RISK2 UNDERSTAND4 USE INTELLIGENCE TO5 LEVERAGE LARGE-SCALE 6 ASSUME YOU'RE STILLINSTILL A BIAS FORACTION13SPONSORED BYTHE THREATANALYTICS ANDTECHNOLOGY TO THEGREATEST EXTENTPOSSIBLE3 COLLABORATEACROSS SECTORSAT RISK
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCE1PRINCIPLEASSUME YOU'RE AT RISKIt isn’t difficult for security leaders to predict thekinds of incidents that can put their organizationsat risk, but Council members admit that convincingtheir organization’s senior leadership to invest inpreparing for a range of scenarios, including themore rare “black swan” events, can be difficult. Theynote it often takes a significant security event to getbusiness executives to take cybersecurity seriously.Since Council members don’t want to wait foranother attack that rises to the level of NotPetya orColonial Pipeline (or worse), they recommend thatindustry organizations, such as ISACs and the CyberDefenders Council, do the kind of scenario planningthat industry group SIFMA does for the securitiesindustry with its Quantum Dawn cyber wargaming exercises. They agree having a third-partyorganization play out and report on these scenarioscould help CISOs make stronger, more crediblebusiness cases to their leadership teams.14SPONSORED BYOne significant yet frequently underestimated riskthat Council members say security leaders andtheir executive teams need to better prepare for isthe risk startups and smaller organizations createfor the larger organizations they serve. They notesmaller companies lack the security maturity ofmany large enterprises, and that startups tend tohave a much greater appetite for risk than largercompanies.“Until large and small companies align on astandardized approach to security, the gap betweentheir maturity and capabilities will only increase, andthe more large companies will experience securityincidents as a result of smaller partners in theirecosystems,” says Nils Puhlmann, a co-founder of theCloud Security Alliance and a veteran technologyindustry CISO.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEUsing open-source software can present similar risks,as the Log4j vulnerability demonstrated in December2021 and beyond. To prevent more Log4j-type supplychain issues in the future, Council members encouragesecurity practitioners to provide more feedback to theopen-source community in a consistent and systematicway. They specifically recommend that application securityresources devote some of their time to looking at opensource code and reporting potential vulnerabilities. MikeOrosz, vice president of information and product securityat Vertiv, suggests that it may be time for the platformshosting open-source code to create terms and conditionsthat state that in exchange for using their software forfree, users agree to report back on any vulnerabilities theyfind, along with potential solutions.15SPONSORED BYAlex Schuchman, CISO for Colgate-Palmolive Company,recommends using tools that validate open sourcelibraries, check for vulnerabilities and dependencies, andprovide curated repositories from which to pull code.Some tools that perform those activities include NodeSecurity Project, Gemnasium, Source Clear, Protecode andSonatype.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCE2PRINCIPLEUNDERSTAND THE THREATDefend Forward security strategies hinge on organizationshaving a keen understanding of the attackers most likelyto target them, the reasons those attackers would want tocompromise them, and the methods they’d be most apt to use,including the network security, application security, and supplychain security weaknesses they could exploit. Since adversarieshave so many vulnerabilities at their disposal, prioritizingvulnerabilities becomes an extremely important component ofproactive defense.Council members note that participating in classified governmentthreat intelligence programs can give organizations visibility intothreats and threat actors they wouldn’t otherwise get. Althoughorganizations would need to put certain policies and controls inplace to obtain the security clearances required to participatein those programs, taking such steps is increasingly necessary,especially for organizations operating in critical infrastructuresectors, as those sectors face heightened threats from nationstate actors.16SPONSORED BYBy understanding howour adversaries aretrying to target us, wecan be more focusedin our defense insteadof trying to protect allthings equally.RICARDO LAFOSSECISO OF THE KRAFT HEINZ COMPANY
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCE317PRINCIPLEINTELLIGENCE SHARING AND COLLABORATIONCouncil members agree that collaboration andintelligence sharing across industries and withthe federal government, CSIRTs, and academicinstitutions is critical to understanding andproactively addressing threats. The drawback:information sharing remains fraught withchallenges. Some of the biggest barriers includeprotecting confidentiality, especially in smallermarkets like Korea and Malaysia, and building andmaintaining trust.Building trust–both within and across industries, andbetween the public and private sectors–obviouslytakes time, but information sharing groups canfacilitate it with policies and processes designed toprotect anonymity. For example, Council membersrepresenting ISACA Singapore and the Global OTISAC say their organizations’ Safe Harbor provisionshave fostered greater openness among theirmembers by granting a degree of anonymity alongwith some liability protection.“Nobody wants to share potentially embarrassingexperiences,” says Hoo Ming Ng, former deputy chiefexecutive for Singapore’s Cyber Security Agency.In addition, the OT-ISAC supports machine-tomachine sharing mechanisms that leverageTraffic Light Protocol (TLP) and anonymoussubmissions. The OT-ISAC has also establisheddifferent classifications for sharing that include:restricted information that can only be shared witha proscribed group; confidential information thatmay only be shared within a specific community;information that can be shared among generalOT-ISAC members, with other groups, and withgovernment partners; and information that can beshared freely with the public.SPONSORED BY
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEDespite industry groups’ efforts to build trust andmake their participants and the organizationsthey represent feel confident in sharing sensitiveintelligence, several Council members say theirorganizations’ corporate policies, intended toreduce their legal exposure, limit the informationthey are allowed to share. To overcome thisparticular hurdle, they say there is a need toshow that the costs of not sharing intelligenceon cyberattacks outweigh potential legal andreputational risks associated with sharing. Reportson the cost of data breaches from public filings withthe US Securities and Exchange Commission (SEC)may help security leaders make this case. Globalregulators also need to address conflicts betweenlaws that penalize organizations for breaches andother laws intended to encourage sharing.Globally, Council members concur that policyand financial incentives are needed to promotecollaboration across the private sector and withpublic sector entities. Market forces, like contractualterms with vendors and suppliers, along with cyberinsurance coverage models, may also serve tofoster collaboration and intelligence sharing.As intelligence sharing increases, Council memberssay platforms are needed to deconflict differentsources of intelligence and help prioritize actions–e.g., for high risk threats, organizations should focuson investigation, deterrence and disruption, andfor low risk threats, organizations can focus onprevention and awareness.I want to be in a world where companies can be more transparent aboutsecurity incidents and where that kind of transparency doesn’t invalidate orcancel a company. We need to resist the impulse to bayonet the wounded.SAM CURRYCSO, CYBEREASON18SPONSORED BY
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCE4PRINCIPLEUSE INTELLIGENCE TO INSTILL A BIAS FOR ACTIONCouncil members say threat intelligence shoulddrive a wide variety of strategic and tactical securitydecisions short of offensive activities, and theyencourage all security practitioners to incorporateactionable threat intelligence into their day to dayactions and decision-making as much as possible.Robert Oh, the executive vice president, head ofcorporate digital strategy and COO of DoosanDigital Innovation, says having the right processes inplace to synthesize and deploy threat intelligence iscritical. It’s also critical to consult with relevant lawenforcement officials before taking any responseactions that may inadvertently create legal orregulatory risks.Design goals based on intelligence can help securityleaders instill a bias for action among themselves andtheir teams. These goals clarify the threat actorsthat security teams are trying to protect theircompanies from, as well as the level of resourcesand sophistication an organization anticipates anadversary would dedicate to an attack.19SPONSORED BY“Design goals drive a level of accountability forachieving specific security and business resiliencyoutcomes,” says Malcolm Harkins, chief securityand trust officer for Epiphany Systems. “Designgoals help security leaders and their teams identifyeverything they need to put in place from a people,process and technology perspective. Securityleaders can then use penetration testing and otherexercises to determine whether or not they’reachieving those goals.”Threat intelligence isn’t only important to securityteams. Beth-Anne Bygum, senior vice president andchief security and compliance officer at Acxiom,and BT emeritus CSO Steve Benton recommendgetting threat intelligence into the hands of businesspeople, especially those working in governance, riskand compliance (GRC) functions, so they can makerisk-intelligent business decisions and take proactivemeasures every day to reduce their organization’sexposure.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEFor example, Bygum recommends that GRC teamsapply threat intelligence to contract negotiationswith vendors. If GRC teams know vulnerabilities incertain vendors’ software are leading to breaches,they know to incorporate “right to audit” clausesinto contracts. “When I have vendors who arenot patching or keeping their code current, I callon that right to audit and to have CISO to CISOconversations between myself and the vendorbecause of the potential supply chain issues the lackof patching could create,” Bygum says.Getting teams to act on intelligence takes aconcerted effort, and sometimes, culture change.While serving as the 36th Commandant of theMarine Corps, General Dunford took creative stepsto build a culture of intelligence sharing. He went sofar as to have posters made in his organization thatposed the following questions: What do I know? Whyis it important? Who else needs to know about it?Have I told them? What needs to be done with thisinformation? Who needs to do it? Did they do it?“These are the kinds of things that are required tomove people beyond the passive state of receivingintelligence to actually do something with it,” he says.BUILDING A CULTURE OF INTELLIGENCE SHARINGKey Questions Security Teams Can Ask Themselves Every DayWhat do I know? Have I told them? Who needs to do it?Why is it important? What needs to bedone with thisinformation? Did they do it? Who else needs toknow about it?20SPONSORED BY
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCE5PRINCIPLELEVERAGE LARGE-SCALE ANALYTICS AND TECHNOLOGY TOTHE GREATEST EXTENT POSSIBLELarge-scale analytics capabilities hold the promiseof enabling security teams to address one of theirbiggest challenges: the fact that they are drowningin data and alerts that do not rise to the level of actualintelligence. The downside is that this infrastructureand these capabilities do not come cheap. What’smore, according to a survey of IT and cybersecurityleaders conducted by CIO Academy Asia, manyorganizations lack the mature data managementcapabilities required to fully leverage artificialintelligence and machine learning at scale for threathunting, early detection and automated response.21SPONSORED BYOn the upside, vendors and services providers areincreasingly building this infrastructure and hostingit on behalf of clients to make it more accessible tomore organizations. The more organizations haveaccess to advanced analytics, the more they cangain an operation-centric view of malicious activityon their systems and networks, and the moreeffectively they can use behavioral indicators toproactively spot and stop suspicious activity in itsearliest stages, before it leads to business impact.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCE6PRINCIPLEASSUME YOU'RE STILL AT RISKCouncil members have shown how a DefendForward mindset and approach can helpsecurity leaders build robust programs fortheir organizations that drive accountability anddeliver meaningful business and cybersecurityoutcomes. Although Defenders may never be ableto completely deter cyberattacks, especially thosethat are nation-state sponsored, if we collectively do22SPONSORED BYthe equivalent of identifying the “doors and windows”that adversaries are likely to exploit, lock them down,and put pressure on third-party partners to do thesame, we’ll have more than a fighting chance to allbut eliminate opportunistic and financially motivatedattacks and curtail the risk posed by nation-statesponsored operations as well.
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCENORTH AMERICA/EMEA COUNCIL MEMBERS23PHILIPP AMANNHEAD OF STRATEGY EUROPEAN CYBERCRIMECENTER, EUROPOLSTEVE BENTONEMERITUS CSO - FORMERDIRECTOR OF PROTECTBT SERVICES ANDOPERATIONS, BTPAUL BIVIANDIRECTOR OFINFORMATIONSECURITY, KIRKLAND &ELLIS LLPKEVIN BROWNCISO, SAICBETH-ANNE BYGUMSVP - CHIEF SECURITYAND COMPLIANCEOFFICER, ACXIOMROLAND CLOUTIERGLOBAL CSO, TIKTOKJOSEPH DUNFORD19TH CHAIRMANOF THE JOINTCHIEFS OF STAFFRENEE GUTTMANNEMERITUS CISO,TIME WARNER AND THECOCA-COLA COMPANYMALCOLM HARKINSCHIEF SECURITYAND TRUST OFFICER,EPIPHANY SYSTEMSPETER KUNZDIVISIONAL CISO, LEICAGEOSYSTEMSRICARDO LAFOSSECISO, THE KRAFT HEINZCOMPANYJANET LEVESQUECISO, ATHENAHEALTHSPONSORED BYSAM CURRYCSO, CYBEREASON
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCENORTH AMERICA/EMEA COUNCIL MEMBERS24DAVE LEWISGLOBAL ADVISORY CISO,CISCODR. YONESY F. NÚÑEZCISO, JACK HENRY &ASSOCIATESKERISSA VARMAMANAGING EXECUTIVE- CYBERSECURITY,VODACOMERIK WILLECISO, AMERICAN AXLE& MANUFACTURINGSPONSORED BYMIKE OROSZVP INFORMATION/PRODUCT SECURITY,VERTIVTHERESA PAYTONCEO, FORTALICE, ANDFORMER WHITE HOUSECIOCHRISTOPHER PETERSVP AND CSO, ENTERGYNILS PUHLMANNCO-FOUNDER, CLOUDSECURITY ALLIANCEALEX SCHUCHMANCISO,COLGATE-PALMOLIVECOMPANY
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEASIA-PACIFIC COUNCIL MEMBERS25HOO MING NGFORMER DEPUTY CHIEFEXECUTIVE, CYBERSECURITY AGENCY OFSINGAPORECHARLES NGEVP - INTERNATIONALBUSINESS &CONSULTING, ENSIGNINFOSECURITYKEITH LEONGMANAGING DIRECTOR GLOBAL DELIVERY, NCSCHUAN WEI HOOGROUP CISO, STENGINEERINGEUGENE TEOVP AND DEPUTY CSO,ULTIMATE KRONOSGROUP (UKG)YUEZHONG BAOCISO, LAZADA GROUPBORIS HAJDUKCISO, TOKOPEDIAMICHAEL BECERRACISO, DHL EXPRESSCHRISTOPHER LEKDIRECTOR CYBERSECURITY, NANYANGTECHNOLOGICALUNIVERSITYSHAO FEI HUANGPRINCIPAL SECURITYARCHITECT, AWSSPONSORED BYSTEVEN SIM KOK LEONGPRESIDENT, ISACASINGAPOREJOHN LEEMANAGING DIRECTOR- APAC, GLOBALRESILIENCE FEDERATION& OT-ISACPEI YUEN WONGCTO, IBM SECURITYSENG WEI KENGCISO, DBS BANKPAUL LEKDIRECTOR - IT RISKMANAGEMENT &SECURITY APJ, MSD(MERCK & CO.)LEONARD ONGAPAC CISO, GEHEALTHCAREJOHNNY KHOPRESIDENT,ASSOCIATION OFINFORMATION SECURITYPROFESSIONALS
DEFEND FORWARD A PROACTIVE MODEL FOR CYBER DETERRENCEASIA-PACIFIC COUNCIL MEMBERS26SHIH HSIEN LIMCISO AND CSO, CERTISJASON WONGGLOBAL HEAD OFIT SECURITY &COMPLIANCE, DYSONDATO’ TS. DR. HAJIAMIRUDIN ABDULWAHABCEO, CYBERSECURITYMALAYSIASHANKAR KRISHNANCISO, AXIATA DIGITALSERVICES & BOOSTMALAYSIAANGEL REDOBLEGROUP CISO,PLDT & SMARTCOMMUNICATIONSYARON SLUTZKYCSO, AGODAROBERT OHEVP - HEAD OFCORPORATE DIGITALSTRATEGY & COO OF DDIBU HEADQUARTERS,DOOSANJOHN TAYLORGROUP CIO TECHNOLOGY &SECURITY, MEDHEALTHJASON LAUCISO, CRYPTO.COMDENNY HUSENGLOBAL HEAD OFINCIDENT RESPONSE,CRYPTO.COMSPONSORED BYMEL MIGRIÑOGROUP CISO, MERALCO(MANILA ELECTRICCOMPANY)
The Cyber Defenders Council is an independent group of preeminent cybersecurity leaders from public- and private-sector organizations around the world. The mission of the Council is to adapt an approach to cyber deterrence, known as "Defend Forward," for private-sector enterprises and to provide prescriptive guidance
